A 311 mobile app embeds long-lived static API keys that call backend microservices. Which change best improves service-to-service authentication?
Select an answer to reveal the explanation.
Short Explanation
Hard-coded forever-keys in a phone app are like taping the building master key under the doormat. Use short-lived tokens or mTLS from a proper identity/secret flow—services proving who they are without eternal secrets in the binary.
Full Explanation
Service and API authentication should avoid long-lived secrets embedded in distributed clients. Short-lived OAuth/OIDC client credentials, workload identities, or mutual TLS with automated rotation reduce theft impact if a mobile binary is reverse-engineered. Exposing keys in the UI, disabling TLS, or sharing one eternal key across apps magnifies compromise.